Document CVE-2024-2961
[glibc.git] / libio / iogetdelim.c
blobc876bfb72e6cc16322ea0a74cb92fa16bf2302d9
1 /* Copyright (C) 1994-2024 Free Software Foundation, Inc.
2 This file is part of the GNU C Library.
4 The GNU C Library is free software; you can redistribute it and/or
5 modify it under the terms of the GNU Lesser General Public
6 License as published by the Free Software Foundation; either
7 version 2.1 of the License, or (at your option) any later version.
9 The GNU C Library is distributed in the hope that it will be useful,
10 but WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 Lesser General Public License for more details.
14 You should have received a copy of the GNU Lesser General Public
15 License along with the GNU C Library; if not, see
16 <https://www.gnu.org/licenses/>.
18 As a special exception, if you link the code in this file with
19 files compiled with a GNU compiler to produce an executable,
20 that does not cause the resulting executable to be covered by
21 the GNU Lesser General Public License. This exception does not
22 however invalidate any other reasons why the executable file
23 might be covered by the GNU Lesser General Public License.
24 This exception applies to code released by its copyright holders
25 in files containing the exception. */
27 #include <stdlib.h>
28 #include "libioP.h"
29 #include <string.h>
30 #include <errno.h>
31 #include <limits.h>
33 /* Read up to (and including) a TERMINATOR from FP into *LINEPTR
34 (and null-terminate it). *LINEPTR is a pointer returned from malloc (or
35 NULL), pointing to *N characters of space. It is realloc'ed as
36 necessary. Returns the number of characters read (not including the
37 null terminator), or -1 on error or EOF. */
39 ssize_t
40 __getdelim (char **lineptr, size_t *n, int delimiter, FILE *fp)
42 ssize_t result;
43 ssize_t cur_len = 0;
44 ssize_t len;
46 CHECK_FILE (fp, -1);
47 _IO_acquire_lock (fp);
48 if (_IO_ferror_unlocked (fp))
50 result = -1;
51 goto unlock_return;
54 if (lineptr == NULL || n == NULL)
56 __set_errno (EINVAL);
57 fseterr_unlocked (fp);
58 result = -1;
59 goto unlock_return;
62 if (*lineptr == NULL || *n == 0)
64 *n = 120;
65 *lineptr = (char *) malloc (*n);
66 if (*lineptr == NULL)
68 fseterr_unlocked (fp);
69 result = -1;
70 goto unlock_return;
74 len = fp->_IO_read_end - fp->_IO_read_ptr;
75 if (len <= 0)
77 if (__underflow (fp) == EOF)
79 result = -1;
80 goto unlock_return;
82 len = fp->_IO_read_end - fp->_IO_read_ptr;
85 for (;;)
87 size_t needed;
88 char *t;
89 t = (char *) memchr ((void *) fp->_IO_read_ptr, delimiter, len);
90 if (t != NULL)
91 len = (t - fp->_IO_read_ptr) + 1;
92 if (__glibc_unlikely (len >= SSIZE_MAX - cur_len))
94 __set_errno (EOVERFLOW);
95 fseterr_unlocked (fp);
96 result = -1;
97 goto unlock_return;
99 /* Make enough space for len+1 (for final NUL) bytes. */
100 needed = cur_len + len + 1;
101 if (needed > *n)
103 char *new_lineptr;
105 if (needed < 2 * *n)
106 needed = 2 * *n; /* Be generous. */
107 new_lineptr = (char *) realloc (*lineptr, needed);
108 if (new_lineptr == NULL)
110 fseterr_unlocked (fp);
111 result = -1;
112 goto unlock_return;
114 *lineptr = new_lineptr;
115 *n = needed;
117 memcpy (*lineptr + cur_len, (void *) fp->_IO_read_ptr, len);
118 fp->_IO_read_ptr += len;
119 cur_len += len;
120 if (t != NULL || __underflow (fp) == EOF)
121 break;
122 len = fp->_IO_read_end - fp->_IO_read_ptr;
124 (*lineptr)[cur_len] = '\0';
125 result = cur_len;
127 unlock_return:
128 _IO_release_lock (fp);
129 return result;
131 libc_hidden_def (__getdelim)
132 weak_alias (__getdelim, getdelim)